These are corrections to several mappings in stig_overlay.xml.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
--- RHEL6/input/auxiliary/stig_overlay.xml | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 9b613eb..8e89373 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -66,7 +66,7 @@ <overlay owner="disastig" ruleid="no_hashes_outside_shadow" ownerid="RHEL-06-000031" disa="366" severity="medium"> <title>The /etc/passwd file must not contain password hashes.</title> </overlay> - <overlay owner="disastig" ruleid="no_uidzero_except_root" ownerid="RHEL-06-000032" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="RHEL-06-000032" disa="366" severity="medium"> <title>The root account must be the only account having a UID of 0.</title> </overlay> <overlay owner="disastig" ruleid="userowner_shadow_file" ownerid="RHEL-06-000033" disa="366" severity="medium"> @@ -234,7 +234,7 @@ <overlay owner="disastig" ruleid="kernel_module_ipv6_option_disabled" ownerid="RHEL-06-000098" disa="366" severity="medium"> <title>The IPv6 protocol handler must not be bound to the network stack unless needed.</title> </overlay> - <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_default_accept_redirects_value" ownerid="RHEL-06-000099" disa="366" severity="medium"> + <overlay owner="disastig" ruleid="sysctl_ipv6_default_accept_redirects" ownerid="RHEL-06-000099" disa="366" severity="medium"> <title>The system must ignore ICMPv6 redirects by default.</title> </overlay> <overlay owner="disastig" ruleid="service_ip6tables_enabled" ownerid="RHEL-06-000103" disa="1118" severity="medium"> @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -747,16 +747,16 @@ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="RHEL-06-000341" disa="366" severity="high"> <title>The snmpd service must not use a default password.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_bashrc" ownerid="RHEL-06-000342" disa="366" severity="low"> <title>The system default umask for the bash shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_cshrc" ownerid="RHEL-06-000343" disa="366" severity="low"> <title>The system default umask for the csh shell must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_etc_profile" ownerid="RHEL-06-000344" disa="366" severity="low"> <title>The system default umask in /etc/profile must be 077.</title> </overlay> - <overlay owner="disastig" ruleid="user_umask_logindefs" ownerid="RHEL-06-000345" disa="366" severity="low"> + <overlay owner="disastig" ruleid="accounts_umask_login_defs" ownerid="RHEL-06-000345" disa="366" severity="low"> <title>The system default umask in /etc/login.defs must be 077.</title> </overlay> <overlay owner="disastig" ruleid="umask_for_daemons" ownerid="RHEL-06-000346" disa="366" severity="low">
On 11/15/13, 2:16 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
<overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium">
<overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay>
This is the only thing that caught my eye.
By moving to nonselected, will it no longer be required to switch into single user mode when /var/log/audit fills up?
From a code perspective, ack.
This is the only thing that caught my eye.
By moving to nonselected, will it no longer be required to switch into single user mode when /var/log/audit fills up?
From a code perspective, ack.
Pushed.
As it happens, CCI-001343 (derived from 800-53r3 AU-5 (4)) is not selected in CNSSI 1253. The patch below backs out the "nonselected" updates. I hope to have a better way to handle non-selected Rules early next week.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
--- RHEL6/input/auxiliary/stig_overlay.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 8e89373..b2c7809 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -351,7 +351,7 @@ <overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -534,7 +534,7 @@ <overlay owner="disastig" ruleid="postfix_network_listening" ownerid="RHEL-06-000249" disa="382" severity="medium"> <title>Mail relaying must be restricted.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000251" disa="778" severity="medium"> + <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000251" disa="778" severity="medium"> <title>The operating system must uniquely identify and authenticate an organization defined list of specific devices and/or types of devices before establishing a connection.</title> </overlay> <overlay owner="disastig" ruleid="ldap_client_start_tls" ownerid="RHEL-06-000252" disa="1453" severity="medium"> @@ -564,7 +564,7 @@ <overlay owner="disastig" ruleid="service_atd_disabled" ownerid="RHEL-06-000262" disa="382" severity="low"> <title>The atd service must be disabled.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000263" disa="1250" severity="low"> + <overlay owner="disastig" ruleid="service_autofs_disabled" ownerid="RHEL-06-000263" disa="1250" severity="low"> <title>Automated file system mounting tools must not be enabled unless needed.</title> </overlay> <overlay owner="disastig" ruleid="service_ntpdate_disabled" ownerid="RHEL-06-000265" disa="382" severity="low">
On 11/15/13, 7:06 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
This is the only thing that caught my eye.
By moving to nonselected, will it no longer be required to switch into single user mode when /var/log/audit fills up?
From a code perspective, ack.
Pushed.
As it happens, CCI-001343 (derived from 800-53r3 AU-5 (4)) is not selected in CNSSI 1253. The patch below backs out the "nonselected" updates. I hope to have a better way to handle non-selected Rules early next week.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
RHEL6/input/auxiliary/stig_overlay.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 8e89373..b2c7809 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -351,7 +351,7 @@
<overlay owner="disastig" ruleid="configure_auditd_max_log_file_action" ownerid="RHEL-06-000161" disa="366" severity="medium"> <title>The system must rotate audit log files that reach the maximum file size.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> + <overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay> <overlay owner="disastig" ruleid="audit_rules_time_adjtimex" ownerid="RHEL-06-000165" disa="169" severity="low"> @@ -534,7 +534,7 @@ <overlay owner="disastig" ruleid="postfix_network_listening" ownerid="RHEL-06-000249" disa="382" severity="medium"> <title>Mail relaying must be restricted.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000251" disa="778" severity="medium"> + <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000251" disa="778" severity="medium"> <title>The operating system must uniquely identify and authenticate an organization defined list of specific devices and/or types of devices before establishing a connection.</title> </overlay> <overlay owner="disastig" ruleid="ldap_client_start_tls" ownerid="RHEL-06-000252" disa="1453" severity="medium"> @@ -564,7 +564,7 @@ <overlay owner="disastig" ruleid="service_atd_disabled" ownerid="RHEL-06-000262" disa="382" severity="low"> <title>The atd service must be disabled.</title> </overlay> - <overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000263" disa="1250" severity="low"> + <overlay owner="disastig" ruleid="service_autofs_disabled" ownerid="RHEL-06-000263" disa="1250" severity="low"> <title>Automated file system mounting tools must not be enabled unless needed.</title> </overlay> <overlay owner="disastig" ruleid="service_ntpdate_disabled" ownerid="RHEL-06-000265" disa="382" severity="low"> --
Would it be simpler to remove the associated XCCDF rules from the STIG profile?
Would it be simpler to remove the associated XCCDF rules from the STIG profile?
I actually removed them for a while, but put them back in. At this point, the "selected" and "not selected" findings are indicated by the presence or absence of the VMS identifiers, respectively.
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
Would it be simpler to remove the associated XCCDF rules from the STIG profile?
I actually removed them for a while, but put them back in. At this point, the "selected" and "not selected" findings are indicated by the presence or absence of the VMS identifiers, respectively.
Ack?
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
Leland,
Here is another of the promised followups to your hanging patch submissions. This patch appears to have been partially applied, perhaps by a later patchset from another party, and I wanted to follow up with you to see if there are any hanging ruleid name changes in your queue.
Upon careful examination, in the file RHEL/6/auxilary/stig_overlay.xml, the following ownerids had their ruleids renamed to the values you suggested: - RHEL-06-000032 - RHEL-06-000099 - RHEL-06-000342 - RHEL-06-000343 - RHEL-06-000344 - RHEL-06-000345
The following was not: - RHEL-06-000163
If RHEL-06-000163 should still be updated to read "nonselected" as its ruleid, let me know, and I will create a small patch. Here are the relevant overlay lines for reference:
<overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay>
- Maura Dailey
On 11/20/2013 03:10 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
Would it be simpler to remove the associated XCCDF rules from the STIG profile?
I actually removed them for a while, but put them back in. At this point, the "selected" and "not selected" findings are indicated by the presence or absence of the VMS identifiers, respectively.
Ack?
Thanks, Leland -- Leland Steinke, Security+ DISA FSO Technical Support Contractor tapestry technologies, Inc 717-267-5797 (DSN 570) leland.j.steinke.ctr@mail.mil (gov't) lsteinke@tapestrytech.com (com'l)
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org
-
Maura Dailey -
Shawn Wells -
Steinke, Leland J Sr CTR DISA DD (US)